Currently, an Email and Web Security (EWS) appliance may be configured to block an Internet Protocol (IP) source address for a configurable amount of time (e.g., 10 minutes) when it detects some form of threat. A centralized system and method for determining overall threats (e.g., a Global Threat Intelligence (GTI) system as provided by McAfee, Inc. of Santa Clara, Calif.) uses a received Email (not at an end-user but at a processor to perform analysis) to generate a fingerprint of the Email. These fingerprints may be used by GTI to gain an accurate picture of the threats traversing the Internet at any one time.
However, if an IP address is completely blocked at all network appliances (sometimes called gateways), the appliance cannot receive the Email from the IP address and therefore cannot fingerprint the data to send to the GTI. Furthermore, currently all network appliances work independently and could all be blocking the same IP address. As a result, new threats may not be effectively being fingerprinted and a GTI could be starved of data, likely reducing effectiveness of the GTI.
There are currently no known prior art solutions that specifically instruct individual appliances whether to block IP addresses in a coordinated fashion. Current centralized solutions provide the same response to all gateway appliances and let the configuration of the individual gateway determine whether the IP should be blocked. One problem with this model is that both a TrustedSource™ and a GTI may not receive enough information about potential threats (TRUSTEDSOURCE is a trademark of McAfee, Inc.).
To solve these and other problems, methods and systems are disclosed to provide a centralized management system for network appliances whereby different network appliances can be instructed in a coordinated manner to temporarily change their configuration, gather information from particular IP addresses, and then resume their previously configured blocking function.